OpenSaas Stack

Beta. The onboarding path and core APIs are stable enough to build on; some advanced features are still evolving. Pin versions for production.

A config-first stack for building admin-heavy applications with Next.js App Router — designed so you can describe features to an AI coding agent (Claude Code) and let the framework handle the technical complexity, with access control enforced on every database operation by default.

• 🔒 Access control first — every context.db operation is automatically secured; denied reads return null/[] (no information leakage).
• 🤖 Built for Claude Code — clear, predictable patterns plus a shipped project CLAUDE.md and MCP tooling, so you build by describing features.
• ⚡ Config-first — define lists, fields, and access rules once; generate the Prisma contract, TypeScript types, and a typed context.
• 🧩 Composable & extensible — shadcn/ui primitives → field components → standalone CRUD → full admin UI; add custom field types without forking core.

Quick Start (3 steps)

You need Node.js 22.18 or newer and pnpm (npm install -g pnpm).

# 1. Scaffold — installs deps and generates the schema
npm create opensaas-app@latest my-app

# 2. Run — starts the Dev database, applies the schema, and runs the app
cd my-app
pnpm dev

3. Build with Claude Code. Open the project in Claude Code and describe what you want — e.g. "add a comments feature to posts" or "add authentication". The scaffolded project ships a CLAUDE.md and MCP tooling so Claude builds within the framework's guardrails.

Your app runs at http://localhost:3000; the auto-generated admin UI is at /admin.

Want authentication from the start?

npm create opensaas-app@latest my-app --with-auth

The scaffolder runs install → generate for you. To skip that and run the steps yourself, pass --no-install.

📚 Full documentation → · Quick Start guide → · Building with Claude Code →

How it works

1. Define your schema in opensaas.config.ts

import { config, list } from '@opensaas/stack-core'
import { text, select, relationship } from '@opensaas/stack-core/fields'
import type { AccessControl } from '@opensaas/stack-core'

// Access control returns a boolean, or a Where filter that scopes the rows.
const isAuthor: AccessControl = ({ session }) =>
  session ? { authorId: { equals: session.userId } } : false

export default config({
  db: { provider: 'postgresql' },
  lists: {
    Post: list({
      fields: {
        title: text({ validation: { isRequired: true } }),
        content: text(),
        status: select({
          options: [
            { label: 'Draft', value: 'draft' },
            { label: 'Published', value: 'published' },
          ],
          defaultValue: 'draft',
        }),
        author: relationship({ ref: 'User.posts' }),
      },
      access: {
        operation: {
          // Anonymous users only see published posts; authors see their own drafts too.
          query: ({ session }) => (session ? true : { status: { equals: 'published' } }),
          update: isAuthor,
          delete: isAuthor,
        },
      },
    }),
    User: list({
      fields: {
        name: text({ validation: { isRequired: true } }),
        email: text({ isIndexed: 'unique' }),
        posts: relationship({ ref: 'Post.author', many: true }),
      },
    }),
  },
})

2. Generate

pnpm generate   # → prisma/contract.ts, prisma/contract.json, .opensaas/types.ts, .opensaas/context.ts

pnpm dev runs this for you on every start and on every edit to opensaas.config.ts — there is no separate database step to run first.

3. Use the access-controlled context in your app

import { getContext } from '@/.opensaas/context'

export async function getPosts() {
  const context = await getContext() // pass a session for authenticated access
  // Access control is enforced automatically.
  return context.db.Post.include('author', (author) => author.select('name')).all()
}

Denied operations return null (single) or [] (many) rather than throwing, so callers can't distinguish "denied" from "doesn't exist". Always null-check writes:

const post = await context.db.Post.update({ where: { id }, data })
if (!post) return { error: 'Not found or access denied' }

What's in the box

Packages

This is the beginning of the README. Read the rest at the original. Read the full README ↗